CVE-2026-75940

CVE-2026-75940 is a use of hard-coded credentials (CWE-798) in the Lenovo Health Android Application, an app distributed exclusively in the Chinese market. Because the CVSS 4.0 vector shows network attack vector with no privileges or user interaction required, the embedded credentials can be exploited remotely by an attacker without any account access or user involvement. A successful attack exposes sensitive health-related information, and the vector's high integrity impact suggests the attacker may also be able to alter stored health data. Affected users are those who have the Lenovo Health Android app installed on their devices in China. As of now there is no public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported.

What to do: Check whether the Lenovo Health app is installed on managed Android devices and update it to the latest version available through Chinese app stores once Lenovo publishes a fix, since no patched version number is specified in the available data. Because the app is consumer-facing and China-exclusive, enterprise defenders outside China should simply verify no users have sideloaded or installed it. Monitor Lenovo's PSIRT advisory for updated version and remediation details.